The long tail of Clop’s PTC hack is just beginning to emerge

Clop exploited a critical zero-day (CVE-2026-12569) in PTC Windchill and FlexPLM to conduct a large-scale extortion campaign: the group deployed a custom Windchill web shell and toolkit to decrypt credentials, move laterally, exfiltrate data from dozens of organizations (including major enterprises), and send extortion demands while vendors and agencies published patches and indicators of compromise.